The sammyb WP Background Tile WordPress plugin versions up to 1.0 contain a CSRF vulnerability that enables stored XSS attacks. This means an attacker can trick an authenticated user into executing unwanted actions that result in malicious scripts being stored and executed within the context of the affected site. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the affected site, potentially compromising user data and site integrity. The CSRF aspect means attackers can induce authenticated users to perform unintended actions. The overall impact includes partial loss of confidentiality, integrity, and availability as indicated by the CVSS vector. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or removing the WP Background Tile plugin if feasible. Implementing standard CSRF protections and input sanitization may help mitigate risk, but no vendor-provided mitigation instructions are currently available.